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Remarks 

In the Office Action dated April 21, 2005, the Examiner rejected claims 1-3, 
6, 8-11, 14, 16-20 under 35 U.S.C. § 103 as being unpatentable over the U.S. Patent to Soha 
4,817,080 in view of the article of Smith, et al. The Examiner rejected claims 4, 5, 7, 12, 13 
and 15 under 35 U.S.C. § 103 as being unpatentable over Soha in view of Smith, et al. and 
further in view of the U.S. Patent to Phal 5,315,580. 

The U.S. Patent to Soha which is cited on page 3, lines 13-15 of the application 
discloses a system that measures traffic statistics by looking at packet contents. Soha is 
concerned with monitoring a statistics-bearing communication bus (or legs of a local area 
network) to guarantee that complete statistics are collected. The system collects distributed 
measurements and forwards them to a centralized point. 

Soha is not concerned with collecting statistics at a plurality of measurement 
points in order to reconstruct a path taken by undesirable network traffic through a computer 
network from a source of the traffic as only provided by the present invention (see Title, Field 
of the Invention and object of the invention). An example of such a path is shown in Figure 
6 of the present invention wherein the path of the attack traffic goes through various Routers 
A, B and C. A word search of the Soha patent reference fail to disclose any mention of the 
words "path" or "reconstruct." 

Smith, et al. is concerned with placing fire walls outside corporate network 
boundaries, into the Internet, to block an attacker. Clearly, Smith, et al. is not concerned with 
analyzing statistics in order to reconstruct a path taken by undesirable network traffic through 
a computer network from a source of the traffic. While Smith, et al. discusses multiple paths 
from a source of an attack there is no discussion of reconstructing such a path or paths. 

Contrary to the Examiner's position, "reconstruction of the path" from a source 
of the undesirable network traffic is not a method used to block or control traffic from getting 
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to its destination. In other words, "blocking" is not the same as "reconstructing. " Dependent 
claims 2 and 10 call for the additional step of "blocking" in addition to the step of 
"reconstructing" in the present application. Path reconstruction is described in detail on page 
18, lines 18-32 of the application. Also, path determination and reconstruction can be found 
at page 17, lines 18-20 and at page 23, lines 2-14. 

Furthermore, the Examiner has not pointed to any teaching within either of the 
cited references to suggest the proposed combination of references. Soha is simply not 
concerned with collecting statistics in order to deal with undesirable network traffic. 
Consequently, one of ordinary skill in the art would not look to Soha to solve the problem only 
addressed by the present invention. 

In summary, the method of "blocking" in Smith, et al. is not the same as 
"reconstructing" a path taken by undesirable network traffic through a computer network from 
a source of the traffic as only provided by the present invention. 

Consequently, in view of the above and in the absence of better art Applicants' 
Attorney respectfully submits the application is in condition for allowance is respectfully 
requested. 



Respectfully submitted, 
Gerald R. Malan, et al. 
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